process-compose-bin

maintainer Quatro · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's official GitHub releases, which is a normal but less verifiable distribution method; the binaries are not built from source, but come from a trusted project host with valid checksums, limiting risk to typical supply-chain concerns for binary packages.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the project's official GitHub releases, which is a normal but less verifiable distribution method; the binaries are not built from source, but come from a trusted project host with valid checksums, limiting risk to typical supply-chain concerns for binary packages.

PKGBUILD

      1# Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
    
      2
    
      3_pkgname=process-compose
    
      4pkgname=process-compose-bin
    
      5pkgver=1.120.0
    
      6pkgrel=1
    
      7pkgdesc="Scheduler and orchestrator to manage non-containerized applications (prebuilt)"
    
      8arch=('x86_64' 'aarch64' 'armv7h')
    
      9url="https://github.com/F1bonacc1/process-compose"
    
      10license=('Apache-2.0')
    
      11provides=("$_pkgname")
    
      12conflicts=("$_pkgname")
    
      13options=('!debug' '!strip')
    
      14source_x86_64=("$pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/v$pkgver/process-compose_linux_amd64.tar.gz")
    
      15source_aarch64=("$pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/v$pkgver/process-compose_linux_arm64.tar.gz")
    
      16source_armv7h=("$pkgname-$pkgver-armv7h.tar.gz::$url/releases/download/v$pkgver/process-compose_linux_arm.tar.gz")
    
      17sha256sums_x86_64=('3792e1ed9f383832eb2362154444e8564fbc8e7e8e7cff8754c68aea5eca086e')
    
      18sha256sums_aarch64=('c5f4fcfc63e849279ac531bce2394a918fb28746339088a7d3d02bb5fb218a68')
    
      19sha256sums_armv7h=('039791eaeff304b96ba409a9b8477a7c5417afd5c7ada4fad21a0c36237a2343')
    
      20
    
      21package() {
    
      22  install -Dm755 process-compose "$pkgdir/usr/bin/process-compose"
    
      23  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24
    
      25  cd "$pkgdir"
    
      26  ./usr/bin/process-compose completion bash 2>/dev/null | install -Dm644 /dev/stdin usr/share/bash-completion/completions/process-compose
    
      27  ./usr/bin/process-compose completion zsh 2>/dev/null | install -Dm644 /dev/stdin usr/share/zsh/site-functions/_process-compose
    
      28  ./usr/bin/process-compose completion fish 2>/dev/null | install -Dm644 /dev/stdin usr/share/fish/vendor_completions.d/process-compose.fish
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 21:14:52	LOW	2